Here you will find a comprehensive list of cryptocurrency exchange hacks
We have covered every documented security breach of major cryptocurrency exchanges and brokers from 2013 to 2020. This list of hacks is continously updated as more news is released and breaches come to light. We also include hacks of KYC or personal customer details, passwords, or data leaks as we feel this is equally important.
Centralized crypto exchanges can be affected by a whole variable of vulnerabilities and security problems, making them a ideal target for malicious actors. You will be surprised of the amount of major cryptocurrency exchanges that have suffered hacks throughout the years, some companies even multiple times, which has resulted in millions of stolen crypto.
Year of Cryptocurrency Exchange Hack 2013 to 2020:
- 2013 (Silk Road)
- 2014 (MtGox, Cryptsy, Mintpal)
- 2015 (Bitstamp, Bter)
- 2016 (Bitfinex)
- 2017 (Nicehash, Bithumb, Yapizon, EtherDelta, OKEX, Coinis)
- 2018 (Bitstamp, Coincheck, BitGrail, CoinSecure, Coinrail, Bithumb, Zaif, MapleChange, Pure Bit)
- 2019 (HitBTC, Cryptopia, Coinmama, DragonEX, Bithumb, Binance, GateHub, Bitrue, Binance, BitMex, VinDAX, Bitpoint, UpBit)
- 2020 (Altsbit, Coincheck)
- Exchange: Silk Road
- Amount: $270,000,000 (171,955 BTC)
Although not a cryptocurrency exchange, but instead a marketplace that accepted cryptocurrency, Silk Road was nonetheless a place where people stored their money. When the FBI managed to track down the exchange's owner they have confiscated all of the BTC that was deposited on the website's account.
- Exchange: MtGox
- Amount: $700,000,000 (850,000 BTC)
It is no surprise that by far the biggest hack in the history of cryptocurrencies happened to Bitcoin in the days of its infancy. The world's most popular exchange, MtGox, finally admitted its insolvency due to ongoing hacks. MtGox employees failed to protect the private keys of its wallet where it stored all the customer's deposits, and hackers would routinely drain this wallet into their own pockets. Everybody who had money stored on the exchange lost it. This amount of Bitcoin is currently worth more than 6 billion USD.
- Exchange: Cryptsy
- Amount: $9,500,000 (13,000 BTC and 300,000 LTC)
The attacker – famous for developing Lucky7Coin – inserted a Trojan malware into Cryptsy’s code so that he could access precious information and transfer cyber currencies – mainly bitcoin and litecoin – out of the exchange’s wallet.
- Exchange: Mintpal
- Amount: $3,200,000 (3,894 BTC)
At one time the cryptocurrency exchange Mintpal was one of the top trading platforms. In the fall of 2014 customers were told Mintpal was going to have new ownership. The exchange was sold to a Moopay executive “Alex Green” who many believe was a shady scammer. Most likely the vulnerability already existed at the time of sale and the new owner just failed to detect and patch it. However, many suggest that it was simply an inside job and Alex Green "hacked" himself.
- Exchange: Bitstamp
- Amount: $5,100,000 (19,000 BTC)
Hackers sent a malicious file to exchange employees. One of the system administrators has neglected security rule #1: "Don't open files from strangers" and opened the file on the machine that had access to the exchange's BTC wallet. 19,000 BTC were stolen.
- Exchange: Bter
- Amount: $1,750,000 (7,000 BTC)
Bter has been hacked before for a smaller amount of money in NXT equivalent. They haven't learned their lesson (as a number of other hacked exchanges don't) and got hacked again in 2015. The real question is, why do they still have customers after being repeatedly hacked again and again?
- Exchange: Bitfinex
- Amount: $72,000,000 (120,000 BTC)
Bitfinex, the exchange most known for the creation of Tether and for sharing executives with the largest active ICO project, EOS, hasn't been infallible itself. Bitfinex advertised itself as having multisignature wallets for each customer. Somehow this multisignature technology didn't help them prevent losing 120,000 of their customer's bitcoins. Instead of repaying their customers from their reserves or going out of business, Bitfinex issued BFX tokens to the hacked customers and promised to buy back these tokens at a later date. Bitfinex is still in business and is doing well, but you should read this blog to learn more about its corrupt history.
- Exchange: EtherDelta
- Amount: $266,789 (308 ETH)
EtherDelta is a decentralized exchange for trading Ethereum tokens, though they do not operate hot wallets with huge amounts of cryptocurrency in them as they are not a centralized platform - there are still ways for an attacker to steal funds. Which is what happened in April 2017, when an attacker was able to breach their DNS server and serve a fake website to visitors.
Anyone who interacted with the fake site ended up sending Ether or tokens to the hacker instead of the actual exchange smart contract.
- Exchange: Yapizon
- Amount: $5,500,000 (3816.2028 Bitcoin)
Another South Korean exchange that suffered a security breach in 2017 was Yapizon. They announced that their hot wallets had been compromised and that this meant 35% of Yapizon's entire Bitcoin funds were stolen. They decided to take a controversial approach to the situation and spread the losses across their users by deducting 36.594% from each user's wallet and issuing their "Fei" token to cover the lost funds.
Ultimately they never recovered from this security breach, ceased their operations and filed for bankruptcy. They claimed it was not an inside job and that authorities had been made aware. The attacker(s) were never identified, but it appears to have been the work of the cyber criminal group known as Lazarus.
- Exchange: Bithumb
- Amount: $7,000,000 (in BTC and ETH)
Bithumb was the fourth largest cryptocurrency exchange at the time by volume was hacked for the first time in July 2017. This was the start of many security incidents with for bithumb, all stemming from an attacker getting control of an employee's pc and being able to steal about 3% of the platform's user credentials. Bithumb has always claimed to not know the exact amount the attacker took, and though local South Korean media claims it was in the billions, estimations today put it around $7 million in Bitcoin and Ethereum.
- Exchange: OKEx
- Amount: $3,000,000 (in Bitcoin)
Not much is known about the Chinese exchange OKEx being hacked in August 2017, notably, because instead of owning up to it they blamed the users. OKEx is the leading Bitcoin trading platform in China, and has always denied that it was hacked. However, it seems a large concidence that multiple users reported their accounts being jeoperdised all at the same period, possibly an employee that went rogue?
OKEx simply said that users who were careless enough to not secure their accounts were at risk of being hacked. It just seems all too much of a coincidence that this happened exactly at the time that Bitcoin trading was banned in China, and as a result the Chinese Police refused to investigate.
- Exchange: Coinis
- Amount: $1,800,000 (Unknown)
A much smaller South Korean exchange that was hacked in September 2017, many believe that it was targeted by the criminal hacking group Lazarus. No details were released on the security breach, or if the hack was reported to the police. Coinis simply advised they would provide compensation for customers that were left out of pocket by the hack.
- Exchange: Nicehash
- Amount: $60,000,000 (4,000 BTC)
Nicehash wasn't an exchange per se. It was a cloud mining service. It allowed people to rent out their computing power to those who wanted to be involved in cryptocurrency mining without having to invest in hardware. Turns out, these people ended up paying to mine all these coins in favor of Nicehash's hackers.
- Exchange: Bitstamp
- Amount: $5,000,000 (18,000 BTC)
Bitstamp was the first major crypto exchange to be hacked in 2018, which resulted in a loss of roughly $5m in bitcoin. This hack showed that cryptocurrency exchanges were now on the radar for all types of security breaches, this attacker took a social engineering approach and had been targetting six Bitstamp employees for weeks. The attacker sent messages to the employees on Skype and email, trying to appeal to their personal interests in hopes that they would open the malware.
- Exchange: Coincheck
- Amount: $534,800,000 (523,000,000 NEM)
While Coincheck exchange managed to use cold wallets for its Bitcoin trading operations, they have neglected security measures on the up-and-coming Asian crypto, NEM. All of NEM deposits on the exchange were stored in one wallet. Whether it was a hack or an inside job - I guess we will never know. And it doesn't matter to those who have lost their money.
- Exchange: BitGrail
- Amount: $195,000,000 (17,000,000 NANO)
Nano is an interesting new 0-fee cryptocurrency that's based on a block lattice architecture as opposed to using a traditional blockchain. As with everything new and shiny, people were eager to get their hands on it. Unfortunately though, no reputable exchange would list the cryptocurrency until it reached some adoption levels. As such, a number of new exchanges emerged that allowed to trade NANO (at that time called RaiBlocks), and users were essentially forced to use insecure exchanges. BitGrail failed to secure its coin storage and an astronomical amount of money was stolen from it. Remember, using a centralized exchange is always a risk. Using a new an unproven centralized exchange is an even greater risk!
- Exchange: CoinSecure
- Amount: $3,300,000 (438 BTC)
CoinSecure has reported that hackers managed to steal 438 bitcoin of their customer's money from exchange's wallets. Exchange owners have now filed a lawsuit against one of exchange's employees, claiming that the hack was instead an inside job.
- Exchange: Coinrail
- Amount: $40,000,000 (in various tokens)
Despite Coinrail being one of the smaller exchanges in Korea, it was a tempting target, considering the amount of money that moves through it. The hackers recognized it as such and the new attack proves that even the smaller exchanges are not safe. In this case, the amount stolen is at $40 million, taken from the exchange in various altcoins.
The most-affected token is NPXS of which around $19.5 million was stolen. The tokens were originally issued by project Pundi X’s Initial Coin Offering (ICO). In addition to this, the hackers stole $13.8 million from another ICO project called Aston X, who are creating a platform that would help decentralize various documents.
Smaller amounts were taken from other cryptos, including Dent’s $5.8 million and $1.1 million that was taken from TRON.
- Exchange: Bithumb
- Amount: $31,000,000 (in Ripple)
Despite already being hacked once in 2017, Bithumb somehow managed to keep most of its userbase. Disaster struck when the South Korean exchange was hacked again in June 2018, during the same month as the Coinrail hack. This has raised a lot of concerns from the Korea Internet & Security Agency, which has advised it is now investigating the matter. Bithumb did not release any details about the security breach, but it appears to have been one of their Ripple hot wallets as they announced they would be able to refund affected customers from their cold storage.
- Exchange: Bancor
- Amount: $23,000,000 (Various tokens)
Bancor became one of the rare decentralized exchanges to be hacked in June 2018, resulting in the theft of $23 million of cryptocurrency tokens. Proof that they are in fact providing a false sense of decentralization. The attacker mostly stole Ether, NPXS tokens, and BNT tokens. However, Bancor was able to freeze their own BNT tokens almost immediately upon realising the breach.
- Exchange: Zaif
- Amount: $60,000,000 (5,966 BTC)
Japanese based exchange Zaif was hacked on September 14th, when access to one of their hot wallets was compromised. This resulted in $60 million in bitcoin, bitcoin cash and MonaCoin being stolen. Oddly enough the exact amount of stolen bitcoin cash is actually unknown, which does not inspire much confidence for Zaif to improve their security measures in the future.
A criminal case with local authorities has already been filed by Zaif, apparently due to the way unauthorized access to the funds was achieved - possibly an employee gone rogue? We can only speculate.
- Exchange: MapleChange
- Amount: $6,000,000 (913 BTC)
The small Canadian based exchange called MapleChange which was seeing a modest volume of around $67,000 USD per day since its launch in May 2018 claimed they were hacked or suffered a bug which resulted in all customer's deposited funds being withdrawn. They then made a strange claim on October 28th that they had to shutdown and delete all their social media until an investigation was made into how this happened but also advised they were sorry it had to end like this. Seemingly insinuating that the investigation had already come to an end and there was nothing they could do?
With no details on their team or how they were legally allowed to operate, this "hack" reeks of an orchastrated exit scam by the exchange.
- Exchange: Pure Bit
- Amount: $30,000,000 (ICO + 13,000 ETH)
After raising over $30,000,000 in an ICO selling their tokens to create a cryptocurrency exchange in South Korea, Pure Bit defrauded their initial investors and customers by executing an exit scam which started on November 9th. Over 13,000 ETH has been moved from Pure Bit's address, and they even went so far as trying to sell a portion of it on UpBit (a large local exchange in South Korea). Luckily, UpBit was made aware these funds were fraudulent and promptly froze their account.
Their website is now offline, social media handles have been deleted and their KakaoTalk channels were emptied by force with their official account being renamed to a phrase that roughly translates into "I'm Sorry."
- Exchange: HitBTC
- Amount: Unknown (A daily volume over $200 million)
Not really a hack per-se, but we felt it was important to include HitBTC on the list following their repeated freezing and blocking of withdrawals on their trading platform. This became especially relavent early this month ahead of the annual Proof Of Keys event.
Users flocked across Reddit and various social media platforms advising that HitBTC was blocking all attempts of withdrawing their funds. A scary thought to think that HitBTC may not really even have your funds available to be withdrawn - so where are they? Remember if you do not have access to your private key, then it is not crypto!
- Exchange: Cryptopia
- Amount: Significant losses (Atleast 19,390 ETH)
On January 13th, users of Cryptopia exchange started to report difficulties accessing & using their accounts. The initial message from Cryptopia was that the exchange had gone into an unscheduled maintenance mode to resolve the problem, at this point it appeared to be a technical issue. Their twitter account later clarified that Cryptopia had been hacked & suffered a security breach, once a staff member realized the exchange was put in maintenance mode to suspend all trading activity.
Cryptopia has issued a statement that they are currently still investigating the hack and have reported the breach to the relevant NZ authorities. At this time, the full amount of lost funds is unknown, however, 19,390 ETH has been seen transferred to an unknown wallet. Given that in the grand scheme of things Cryptopia is quite a small exchange, the possibility of an inside job will definitely be on everyone's mind - especially given the current bear market we are witnessing that causes numerous small exchanges to close their doors. Time will tell?
- Exchange: Cryptopia
- Amount: 1,675 ETH
Well, I believe this is the first time this ever happened? Cryptopia after being hacked on the 13th January were then hacked once more just 15 days later. This confirms what had been dreaded: Cryptopia no longer has any control over its wallets. The attacker is definitely the same hacker who struck just 15 days prior, which means they have access to all of Cryptopia's private keys.
And it just begs the question, where was Cryptopia's plan to save customer's remaining funds? Why did they not have a process in place? Another hack that shows centralized exchanges only operate with their profit line in mind and never with ensuring customer security.
- Exchange: Coinmama
- Amount: 450,000k user emails and passwords
Coinmama is one of the world's largest crypto brokers, boasting a total of 1.3 million active users but this does not mean they are immune to security breaches. On February 15th, their customer database was hacked which led to over 450k user emails and passwords being leaked.
This type of hack can have devastating consequences for any Coinmama users, as it can potentially mean the loss of their saved personal details. This could include favourite payment methods such as credit cards & billing addresses, or could even be their KYC details (ID cards or passports). All details that a hacker will be happy to sell on the dark web.
- Exchange: Bithumb
- Amount: $13,000,000 (EOS and XRP)
Bithumb really appears to be quite relaxed on security! This is the third time they have been hacked, though this time they have claimed it was an inside job. The exchange was hacked for 3.07 million EOS and 20.2 million XRP, and the attacker was able to liquidate most of it.
Bithumb advised they found no evidence of an external exploit, but it looks like they do not really know what happened! Very reassuring. I would recommend moving off this exchange. Security researchers believe this happened because bithumb was not using a multisig system on its EOS wallet so the attacker was able to move the funds with just a single key.
- Exchange: DragonEX
- Amount: $7,000,000 (Various tokens)
The Singapore-based exchange DragonEX was hacked in March 2019, and lost an estimated USD 7 Million to the attacker. The company behind the exchange has not really released any details regarding the security breach, only that they will not be going bankrupt. The exchange promised to figure out a compensation plan for their users by providing USDT credit or Dragon Token (DT).
- Exchange: Binance
- Amount: 7,000 BTC
Binance experienced a major breach on May 7 and the hackers were able to withdraw 7,000 bitcoins (currently over USD $40 million). Essentially the hackers were able to steal funds from Binance's hot wallet and seemingly was done in a way to bypass all of Binance's security checks. After the transaction was detected, all withdrawals and deposits were immediately suspended while Binance investigates.
According to Binance's own announcement, the hackers used several tactics of phishing and viruses - which allowed them to obtain a large amount of 2FA codes and API keys. They also mentioned other info had been jeopardised, which we can fathom could potentially refer to customers private details being stolen also.
Lost funds will be covered by Binance's SAFU scheme where they allocate 10% of all trading fees to protect user funds following extreme cases. And though being prepared to cover stolen user funds is is a good initiative, the reality means we are going to see a huge dump of BNB by Binance to cover this USD $40 million.
- Exchange: Gatehub
- Amount: $10,000,000 (XRP)
Gatehub acknowledged that a hacker was able to gain access to their database that stored their user's access tokens. This meant the hacker could use their API to make valid calls for the users and steal their funds. Though the attack was apparently very sophisticated Gatehub came under fire for being very slow to respond. Apparently a third party made them aware of the breach and security exploit immediately after the first funds were moved to the attacker's wallet, but Gatehub did not react for several days, resulting in a much larger loss of funds.
Unfortunately another example that many of these centralized platforms do not have their user's wellbeing as a priority!
- Exchange: Bitrue
- Amount: $5,000,000 (XRP and ADA)
Another Singaporean based exchange to be hacked in 2019 was Bitrue. A major attack resulted in their hot wallets being compromised, resulting in the theft of 9.3 million XRP and 2.5 million ADA. Bitrue advised that the attacker used an exploit to gain access to 90 Bitrue user's accounts.
Initially the exchange advised they were down for maintenance, but then quickly backtracked to apologize for misleading their customers. They have also confirmed that lost funds will be compensated. And Bitrue also confirmed they have reached out to Singaporean authorities.
- Exchange: Binance
- Amount: KYC data, thought to be in the range of 60,000 user details (passports, licenses, selfies).
Another immense danger of using a centralized cryptocurrency platform to trade is not being in control of your personal data.
Binance is currently investigating the alleged leak of over 60,000 customer KYC details, however, multiple media websites have claimed the hacker has already shared over 1,000 of passports and selfies with them as proof of the hack. There is also public telegram channel which is periodically leaking KYC data which appears to be controlled by the hacker himself under the pseudo Guardian M. And though none of the leaked images have Binance's security watermark on them, in every selfie the users have written down Binance, 02/24/19.
The current theory is that either a third party Binance was using for KYC verification during a busy period was hacked, or alternatively, these details were obtained during the 7,000 BTC Binance hack back in May. Either way it does not look good for Binance, and now are on our list of cryptocurrency exchange hacks twice for 2019.
- Exchange: Bitpoint
- Amount: $28,000,000
Another Japanese exchange to suffer a hack in 2019 was Bitpoint, which lost over 3 billion yen (roughly $28 million) of its customer's funds. The hot wallet that was breached was used for fiver major cryptocurrencies. The majority of the stolen funds was in Bitcoin, Bitcoin Cash, Ripple. This hack came only a year after Japanese authorities urged exchanges to take better security measures and precautions following Coincheck being hacked of over $400 million. It seems that Bitpoint did not take these recommendations to heart.
No details around the breach were released, however, after suspending all trading while investigating Bitpoint later announced they would refund all the customer's lost funds and resumed operations.
- Exchange: BitMex
- Amount: Massive Email Data Leak
Some may not class data leaks as seriously as a hack that causes a loss of funds, but having your personal deatils stolen is just as bad - sometimes worse in certain cases. This was not really a hack, but shows a lack of awareness from BitMex when it comes to handling sensitive customer details.
The popular crypto derivatives exchange BitMex, accidentally leaked data related to its users when they sent out a message and did not correctly use its mass mail servers. This resulted in the message having the email addresses of other users in the "to" field.
- Exchange: Gatehub
- Amount: 1.4 million user account passwords
On November 19th, Ars Tecnica reported a massive password dump online. A security researcher Troy Hunt, confirmed that these 2.2 million users were from two websites: GateHub and EpicBot (a Runescape bot provider). One of the websites was the cryptocurrency wallet GateHub, and the stolen information contained over 1.9 million user's personal information. The dump had registered email addresses, passwords and even two-factor authentication keys.
GateHub officials have advised that none of the wallet's have been accessed, but it was only in June that they lost over $10 million worth of XRP to hackers. Anyone still using GateHub at this point, is simply playing with fire as it will only be a matter of time before you lose all your funds to their security missmanagement.
- Exchange: VinDAX
- Amount: $500,000
The vietnamese based exchange VinDAX was hacked in November 2019, losing over half a million U.S. dollars worth of cryptocurrencies. VinDAX did not publish many details around the hack, some sources announced the hacked funds were in over 23 different cryptocurrencies. VinDAX also claimed they made a full recovery after the hack. It is unclear if this meant they refunded customers or if customers even suffered any losses. VinDAX mostly deals with token sales for unknown blockchain projects, so the stolen funds could have potentially been in tokens that were not really even on the market as of yet. Given the exchange operates out of Vietnam, regulations would be low. Other sources report VinDAX simply asked the projects to provide them with enough tokens to cover the "accident".
- Exchange: UpBit
- Amount $50M (342,000 ETH)
At this point you may be forgiven for asking yourself, is there a South Korean cryptocurrency exchange that has not been hacked? On 27th November, UpBit, the major cryptocurrency exchange that is a a subsidiary of the Korean tech giant Kakao notified its users of a hack that resulted in the loss of 342,000 ETH from one of its hot wallets.
The security breach has been confirmed by UpBit's CEO Lee Seok-woo, though he stopped short of calling it a hack. We could therefore be looking at an inside job situation where an employee went rogue? Or alternatively the CEO simply did not want to really acknowledge the hack, it is thought that many security breaches go unreported in the world of crypto.
UpBit has confirmed corporate assets will be used to cover the loss of any of their user's assets. They also advised other large transactions from their exchanges wallets are normal, as they have taken the steps to move all their funds to cold storage while they figure out the extent of the hack. In this situation, being part of Kakao, the company will have the funds available to cover their users - of course, it will take several weeks before withdrawals and deposits are back operational.
- Exchange: Altsbit
- Amount: $70,000 worth of cryptocurrency
After just being around for a couple of months the Italian exchange Altsbit was hacked. Strangely the exchange first announced that all of its funds had been stolen during the hack. Later it turned out that only half of the crypto it was storing was stolen. In total the exchange lost 6,929 BTC, 23,210 ETH, 3,924,082 ARRR, 414,154 VRSC & 1,066 KMD to the hack. It is very unclear how this hack was pulled off, Altsbit advised it would partially refund lost funds of its users and then closed down in May 2020. The hacking group Lulzsec did claim they were behind the hack, but without any details released on how the funds were stolen this is hard to confirm.
- Exchange: Coincheck
- Amount: Personal User Data
Tokyo-based organization Coincheck announced in May that they had been victim to a phishing attack on their domain. The hackers were able to hijack their website domain, allowing them to target customers with a phishing attack. This means that users were unknowningly providing their personal details such as names, registered addresses, birth dates, phone numbers, and ID Selfies to the hackers. Coincheck confirmed that personal information had been exposed, but that no digital assets were stolen. Not a great look for a platform that lost over $500 million in NEM coins to hackers in 2018.
Remember it is not crypto if you do not have control of your private key!
Have information about a hack that we haven't listed? Reach out on our forum and we will make sure it is updated.
Let this be a reminder to everybody that the world of cryptocurrency is a wild west and you shouldn't trust your money to everyone. Instead, trade on decentralized exchanges, and store funds in one of these wallets.
Learn More about Saturn Network:
Follow Team Saturn on Twitter for our latest announcements and updates, join our HODL 2020 Investment Program to support development of our roadmap, and share your unique referral link to get extra rewards!